Commits: 19
Commit Authors: 6
Issues Resolved: 0
Security Advisories Resolved: 20
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (6)
Mike Bradeen: (3)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (6):
- chan_unistim.c: Prevent overrun of phone_number field.
- res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Mike Bradeen (3):
- ooh323c: not checking for IE minimum length
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
ooh323c: not checking for IE minimum length
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

ooh323c: not checking for IE minimum length

Author: Mike Bradeen
Date: 2022-06-06

When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.

Resolves: #GHSA-h5hv-jmgj-92q2

res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.

Author: George Joseph
Date: 2026-06-12

The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.

The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.

Resolves: #GHSA-wcvv-g26m-wx5c

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

Asterisk
Asterisk Release 22.10.1 25 Juni 2026 om 19:17

Asterisk Release 22.10.1

Asterisk

Door: asteriskteam

25 Juni 2026 om 19:17

The Asterisk Development Team would like to announce security release
Asterisk 22.10.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.10.1

Change Log for Release asterisk-22.10.1

Links:

Summary:

Commits: 19
Commit Authors: 6
Issues Resolved: 0
Security Advisories Resolved: 20
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (6)
Mike Bradeen: (3)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (6):
- chan_unistim.c: Prevent overrun of phone_number field.
- res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Mike Bradeen (3):
- ooh323c: not checking for IE minimum length
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
ooh323c: not checking for IE minimum length
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

ooh323c: not checking for IE minimum length

Author: Mike Bradeen
Date: 2022-06-06

When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.

Resolves: #GHSA-h5hv-jmgj-92q2

res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.

Author: George Joseph
Date: 2026-06-12

The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.

The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.

Resolves: #GHSA-wcvv-g26m-wx5c

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

Asterisk
Asterisk Release 21.12.3 25 Juni 2026 om 19:15

Asterisk Release 21.12.3

Asterisk

Door: asteriskteam

25 Juni 2026 om 19:15

The Asterisk Development Team would like to announce security release
Asterisk 21.12.3.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.3
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 21.12.3

Change Log for Release asterisk-21.12.3

Links:

Summary:

Commits: 21
Commit Authors: 7
Issues Resolved: 0
Security Advisories Resolved: 20
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

acl: Add ACL support to http and ari
A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (6)
Joshua C. Colp: (1)
Mike Bradeen: (4)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (6):
- chan_unistim.c: Prevent overrun of phone_number field.
- res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Joshua C. Colp (1):
- build: Fix GCC discarded-qualifiers const errors.
Mike Bradeen (4):
- ooh323c: not checking for IE minimum length
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
- acl: Add ACL support to http and ari
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
ooh323c: not checking for IE minimum length
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow
acl: Add ACL support to http and ari
build: Fix GCC discarded-qualifiers const errors.

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

ooh323c: not checking for IE minimum length

Author: Mike Bradeen
Date: 2022-06-06

When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.

Resolves: #GHSA-h5hv-jmgj-92q2

res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.

Author: George Joseph
Date: 2026-06-12

The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.

The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.

Resolves: #GHSA-wcvv-g26m-wx5c

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

acl: Add ACL support to http and ari

Author: Mike Bradeen
Date: 2026-02-27

Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.

Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.

resolves: #1799

UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information

build: Fix GCC discarded-qualifiers const errors.

Author: Joshua C. Colp
Date: 2026-02-12

GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:

The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
It was declared const and never should have been.

Asterisk
Asterisk Release 20.20.1 25 Juni 2026 om 19:14

Asterisk Release 20.20.1

Asterisk

Door: asteriskteam

25 Juni 2026 om 19:14

The Asterisk Development Team would like to announce security release
Asterisk 20.20.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.20.1

Change Log for Release asterisk-20.20.1

Links:

Summary:

Commits: 18
Commit Authors: 6
Issues Resolved: 0
Security Advisories Resolved: 19
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (6)
Mike Bradeen: (2)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (6):
- chan_unistim.c: Prevent overrun of phone_number field.
- res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Mike Bradeen (2):
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.

Author: George Joseph
Date: 2026-06-12

The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.

The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.

Resolves: #GHSA-wcvv-g26m-wx5c

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

Asterisk
Asterisk Release certified-22.8-cert3 25 Juni 2026 om 19:09

Asterisk Release certified-22.8-cert3

Asterisk

Door: asteriskteam

25 Juni 2026 om 19:09

The Asterisk Development Team would like to announce security release
Certified Asterisk 22.8-cert3.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-22.8-cert3

Change Log for Release asterisk-certified-22.8-cert3

Links:

Summary:

Commits: 21
Commit Authors: 7
Issues Resolved: 0
Security Advisories Resolved: 20
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

acl: Add ACL support to http and ari
A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (6)
Joshua C. Colp: (1)
Mike Bradeen: (4)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (6):
- chan_unistim.c: Prevent overrun of phone_number field.
- res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Joshua C. Colp (1):
- build: Fix GCC discarded-qualifiers const errors.
Mike Bradeen (4):
- ooh323c: not checking for IE minimum length
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
- acl: Add ACL support to http and ari
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
ooh323c: not checking for IE minimum length
res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow
acl: Add ACL support to http and ari
build: Fix GCC discarded-qualifiers const errors.

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

ooh323c: not checking for IE minimum length

Author: Mike Bradeen
Date: 2022-06-06

When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.

Resolves: #GHSA-h5hv-jmgj-92q2

res_ari: Ensure read-only users are properly authorized via REST Over WebSocket.

Author: George Joseph
Date: 2026-06-12

The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.

The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.

Resolves: #GHSA-wcvv-g26m-wx5c

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

acl: Add ACL support to http and ari

Author: Mike Bradeen
Date: 2026-02-27

Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.

Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.

resolves: #1799

UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information

build: Fix GCC discarded-qualifiers const errors.

Author: Joshua C. Colp
Date: 2026-02-12

GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:

The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
It was declared const and never should have been.

Asterisk
Asterisk Release certified-20.7-cert11 25 Juni 2026 om 19:07

Asterisk Release certified-20.7-cert11

Asterisk

Door: asteriskteam

25 Juni 2026 om 19:07

The Asterisk Development Team would like to announce security release
Certified Asterisk 20.7-cert11.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert11

Change Log for Release asterisk-certified-20.7-cert11

Links:

Summary:

Commits: 18
Commit Authors: 7
Issues Resolved: 0
Security Advisories Resolved: 18
- GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
- GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
- GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
- GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
- GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
- GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
- GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
- GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
- GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
- GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
- GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
- GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
- GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
- GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
- GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
- GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
- GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

User Notes:

Upgrade Notes:

Developer Notes:

ARI: Make ARI applications respect live_dangerously.
ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959

Commit Authors:

George Joseph: (5)
Joshua C. Colp: (1)
Mike Bradeen: (2)
Milan Kyselica: (7)
Pengpeng Hou: (1)
Roberto Paleari: (1)
ThatTotallyRealMyth: (1)

Issue and Commit Detail:

Closed Issues:

!GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
!GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
!GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
!GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
!GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
!GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
!GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
!GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
!GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
!GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
!GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
!GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
!GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
!GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
!GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
!GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
!GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
!GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Commits By Author:

George Joseph (5):
- chan_unistim.c: Prevent overrun of phone_number field.
- pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
- ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
- ARI: Make ARI applications respect live_dangerously.
- res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
Joshua C. Colp (1):
- build: Fix GCC discarded-qualifiers const errors.
Mike Bradeen (2):
- manager: Use remote address in user error logging
- ooh323: Prevent potential buffer overflow in trace logging
Milan Kyselica (7):
- res_xmpp: Fix stack buffer overflow in namespace prefix handling
- res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
- res_config_ldap: Escape LDAP filter values per RFC 4515
- cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
- http: Escape error page text to prevent reflected XSS
- codec_codec2: Only process complete Codec2 frames in decoder
- format_ogg_speex: Add bounds check to prevent heap buffer overflow
Pengpeng Hou (1):
- app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
Roberto Paleari (1):
- res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
ThatTotallyRealMyth (1):
- ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Commit List:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.
chan_unistim.c: Prevent overrun of phone_number field.
pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.
ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.
ARI: Make ARI applications respect live_dangerously.
res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.
res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser
manager: Use remote address in user error logging
ooh323: Prevent potential buffer overflow in trace logging
app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers
res_xmpp: Fix stack buffer overflow in namespace prefix handling
res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser
res_config_ldap: Escape LDAP filter values per RFC 4515
cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection
http: Escape error page text to prevent reflected XSS
codec_codec2: Only process complete Codec2 frames in decoder
format_ogg_speex: Add bounds check to prevent heap buffer overflow
build: Fix GCC discarded-qualifiers const errors.

Commit Details:

ast_loggrabber: Install the ast_tsconvert.py script to a secure temp directory.

Author: ThatTotallyRealMyth
Date: 2026-03-19

The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.

Resolves: #GHSA-xgj6-2gc5-5x9c

chan_unistim.c: Prevent overrun of phone_number field.

Author: George Joseph
Date: 2026-06-15

Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.

Resolves: #GHSA-3g56-cgrh-95p5

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Author: George Joseph
Date: 2026-06-10

The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6

ooh323c/ooq931.c: Ensure ooQ931Decode doesn't run out-of-bounds.

Author: George Joseph
Date: 2026-06-02

Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.

Resolves: #GHSA-746q-794h-cc7f

ARI: Make ARI applications respect live_dangerously.

Author: George Joseph
Date: 2026-05-21

DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.

Resolves: #GHSA-vrfp-mg3q-3959

res_rtp_asterisk.c: Address 2 potential T.140 RED buffer overruns.

Author: George Joseph
Date: 2026-04-27

Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.

Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94

res/res_pjsip_pubsub.c: Fix buffer over-read in MWI body parser

Author: Roberto Paleari
Date: 2026-04-29

Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".

Resolves: #GHSA-8jw3-ccr9-xrmf

manager: Use remote address in user error logging

Author: Mike Bradeen
Date: 2026-03-30

To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.

Resolves: #GHSA-3rhj-hhw7-m6fw

ooh323: Prevent potential buffer overflow in trace logging

Author: Mike Bradeen
Date: 2026-03-31

Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.

Resolves: #GHSA-x348-j6c9-77f3

app_sms: Bound protocol 1 SMS unpacking to fixed-size buffers

Author: Pengpeng Hou
Date: 2026-04-01

The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.

Resolves: #GHSA-q9fr-m7g8-6ph5

res_xmpp: Fix stack buffer overflow in namespace prefix handling

Author: Milan Kyselica
Date: 2026-03-26

The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.

Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.

Resolves: #GHSA-mxgm-8c6f-5p8f

res_pjsip_pubsub: Add width limit to sscanf in MWI NOTIFY parser

Author: Milan Kyselica
Date: 2026-03-24

The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.

Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.

Resolves: #GHSA-589g-qgf8-m6mx

res_config_ldap: Escape LDAP filter values per RFC 4515

Author: Milan Kyselica
Date: 2026-03-23

The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.

Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.

Resolves: #GHSA-r6c2-hwc2-j4mp

cel_pgsql, cel_tds: Escape eventtype field to prevent SQL injection

Author: Milan Kyselica
Date: 2026-03-23

The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.

For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.

For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.

Resolves: #GHSA-ph27-3m5q-mj5m

http: Escape error page text to prevent reflected XSS

Author: Milan Kyselica
Date: 2026-04-08

The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp

codec_codec2: Only process complete Codec2 frames in decoder

Author: Milan Kyselica
Date: 2026-04-08

The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.

Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.

Resolves: #GHSA-qf8j-jp7h-c5hx

format_ogg_speex: Add bounds check to prevent heap buffer overflow

Author: Milan Kyselica
Date: 2026-03-23

The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h

build: Fix GCC discarded-qualifiers const errors.

Author: Joshua C. Colp
Date: 2026-02-12

GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:

The return value should be considered const.
The value passed to strchr or strrchr can be cast as it is
expected and allowed to be modified.
The pointer passed to strchr or strrchr is not meant to be
modified and so the contents must be duplicated.
It was declared const and never should have been.

Asterisk
Asterisk Release 23.4.0 11 Juni 2026 om 16:30

Asterisk Release 23.4.0

Asterisk

Door: asteriskteam

11 Juni 2026 om 16:30

The Asterisk Development Team would like to announce
the release of asterisk-23.4.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.4.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.4.0

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release 22.10.0 11 Juni 2026 om 16:27

Asterisk Release 22.10.0

Asterisk

Door: asteriskteam

11 Juni 2026 om 16:27

The Asterisk Development Team would like to announce
the release of asterisk-22.10.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.10.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.10.0

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release 20.20.0 11 Juni 2026 om 16:24

Asterisk Release 20.20.0

Asterisk

Door: asteriskteam

11 Juni 2026 om 16:24

The Asterisk Development Team would like to announce
the release of asterisk-20.20.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.20.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.20.0

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release 23.4.0-rc1 4 Juni 2026 om 16:13

Asterisk Release 23.4.0-rc1

Asterisk

Door: asteriskteam

4 Juni 2026 om 16:13

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-23.4.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.4.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.4.0-rc1

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release 22.10.0-rc1 4 Juni 2026 om 16:03

Asterisk Release 22.10.0-rc1

Asterisk

Door: asteriskteam

4 Juni 2026 om 16:03

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-22.10.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.10.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.10.0-rc1

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release 20.20.0-rc1 4 Juni 2026 om 15:04

Asterisk Release 20.20.0-rc1

Asterisk

Door: asteriskteam

4 Juni 2026 om 15:04

The Asterisk Development Team would like to announce
release candidate 1 of asterisk-20.20.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.0-rc1
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.20.0-rc1

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.20.0-rc1

Links:

Summary:

Commits: 53
Commit Authors: 24
Issues Resolved: 43
Security Advisories Resolved: 0

Asterisk
Asterisk Release certified-18.9-cert18 1 Mei 2026 om 15:52

Asterisk Release certified-18.9-cert18

Asterisk

Door: asteriskteam

1 Mei 2026 om 15:52

The Asterisk Development Team would like to announce
the release of Certified asterisk-18.9-cert18.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert18
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

Repository: https://github.com/asterisk/asterisk
Tag: certified-18.9-cert18

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-certified-18.9-cert18

Links:

Summary:

Commits: 1
Commit Authors: 1
Issues Resolved: 1
Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

Naveen Albert: (1)

Issue and Commit Detail:

Closed Issues:

ASTERISK-30265: res_pjsip_session: Fix missing PLAR support on INVITEs

Commits By Author:

Naveen Albert (1):
- res_pjsip_session.c: Map empty extensions in INVITEs to s.

Commit List:

res_pjsip_session.c: Map empty extensions in INVITEs to s.

Commit Details:

res_pjsip_session.c: Map empty extensions in INVITEs to s.

Author: Naveen Albert
Date: 2022-10-17

Some SIP devices use an empty extension for PLAR functionality.

Rather than rejecting these empty extensions, we now use the s
extension for such calls to mirror the existing PLAR functionality
in Asterisk (e.g. chan_dahdi).

ASTERISK-30265 #close

Asterisk
Asterisk Release 23.3.0 9 April 2026 om 18:37

Asterisk Release 23.3.0

Asterisk

Door: asteriskteam

9 April 2026 om 18:37

The Asterisk Development Team would like to announce
the release of asterisk-23.3.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.3.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.3.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.3.0

Links:

Summary:

Commits: 50
Commit Authors: 21
Issues Resolved: 34
Security Advisories Resolved: 0

Asterisk
Asterisk Release 22.9.0 9 April 2026 om 18:24

Asterisk Release 22.9.0

Asterisk

Door: asteriskteam

9 April 2026 om 18:24

The Asterisk Development Team would like to announce
the release of asterisk-22.9.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.9.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.9.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.9.0

Links:

Summary:

Commits: 50
Commit Authors: 21
Issues Resolved: 34
Security Advisories Resolved: 0

Asterisk
Asterisk Release 20.19.0 9 April 2026 om 18:13

Asterisk Release 20.19.0

Asterisk

Door: asteriskteam

9 April 2026 om 18:13

The Asterisk Development Team would like to announce
the release of asterisk-20.19.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.19.0
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.19.0

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.19.0

Links:

Summary:

Commits: 50
Commit Authors: 21
Issues Resolved: 34
Security Advisories Resolved: 0

Asterisk
Asterisk Release 23.3.0-rc2 2 April 2026 om 19:03

Asterisk Release 23.3.0-rc2

Asterisk

Door: asteriskteam

2 April 2026 om 19:03

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-23.3.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.3.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 23.3.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-23.3.0-rc2

Links:

Summary:

Commits: 2
Commit Authors: 2
Issues Resolved: 3
Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

George Joseph: (1)
nappsoft: (1)

Issue and Commit Detail:

Closed Issues:

1844: [bug]: cdrel_custom isn't respecting the default time format for CEL records
1845: [bug]:res_cdrel_custom produces wrong float timestamps
1852: [bug]: res_cdrel_custom: connection to the sqlite3 database closes from time to time

Commits By Author:

George Joseph (1):
- res_cdrel_custom: Resolve several formatting issues.
nappsoft (1):
- res_cdrel_custom: do not free config when no new config was loaded

Commit List:

res_cdrel_custom: do not free config when no new config was loaded
res_cdrel_custom: Resolve several formatting issues.

Commit Details:

res_cdrel_custom: do not free config when no new config was loaded

Author: nappsoft
Date: 2026-04-02

When the res_cdrel_custom modules is reloaded and the config has not been changed asterisk should not free the old config. Otherwise the connection to the database will be closed and no new connection will be opened.

Resolves: #1852

res_cdrel_custom: Resolve several formatting issues.

Author: George Joseph
Date: 2026-03-31

Several issues are resolved:

Internally, floats were used for timestamp values but this could result
in wrapping so they've been changed to doubles.
Historically, the default CEL eventtime format is <seconds>.<microseconds>
with <microseconds> always being 6 digits. This should have continued to be
the case but res_cdrel_custom wasn't checking the dateformat setting in
cel.conf and was defaulting to %F %T. res_cdrel_custom now gets the default
date format from cel.conf, which will be whatever the dateformat parameter
is set to or <seconds>.<microseconds> if not set.
The timeval field formatter for both CDR and CEL wasn't handling custom
strftime format strings correctly. This is now fixed so you should be able
to specifiy custom strftime format strings for the CEL eventtime and CDR
start, answer and end fields. For example: eventtime(%FT%T%z).

Resolves: #1844
Resolves: #1845

Asterisk
Asterisk Release 22.9.0-rc2 2 April 2026 om 18:52

Asterisk Release 22.9.0-rc2

Asterisk

Door: asteriskteam

2 April 2026 om 18:52

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-22.9.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.9.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 22.9.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-22.9.0-rc2

Links:

Summary:

Commits: 2
Commit Authors: 2
Issues Resolved: 3
Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

George Joseph: (1)
nappsoft: (1)

Issue and Commit Detail:

Closed Issues:

1844: [bug]: cdrel_custom isn't respecting the default time format for CEL records
1845: [bug]:res_cdrel_custom produces wrong float timestamps
1852: [bug]: res_cdrel_custom: connection to the sqlite3 database closes from time to time

Commits By Author:

George Joseph (1):
- res_cdrel_custom: Resolve several formatting issues.
nappsoft (1):
- res_cdrel_custom: do not free config when no new config was loaded

Commit List:

res_cdrel_custom: do not free config when no new config was loaded
res_cdrel_custom: Resolve several formatting issues.

Commit Details:

res_cdrel_custom: do not free config when no new config was loaded

Author: nappsoft
Date: 2026-04-02

When the res_cdrel_custom modules is reloaded and the config has not been changed asterisk should not free the old config. Otherwise the connection to the database will be closed and no new connection will be opened.

Resolves: #1852

res_cdrel_custom: Resolve several formatting issues.

Author: George Joseph
Date: 2026-03-31

Several issues are resolved:

Internally, floats were used for timestamp values but this could result
in wrapping so they've been changed to doubles.
Historically, the default CEL eventtime format is <seconds>.<microseconds>
with <microseconds> always being 6 digits. This should have continued to be
the case but res_cdrel_custom wasn't checking the dateformat setting in
cel.conf and was defaulting to %F %T. res_cdrel_custom now gets the default
date format from cel.conf, which will be whatever the dateformat parameter
is set to or <seconds>.<microseconds> if not set.
The timeval field formatter for both CDR and CEL wasn't handling custom
strftime format strings correctly. This is now fixed so you should be able
to specifiy custom strftime format strings for the CEL eventtime and CDR
start, answer and end fields. For example: eventtime(%FT%T%z).

Resolves: #1844
Resolves: #1845

Asterisk
Asterisk Release 20.19.0-rc2 2 April 2026 om 18:41

Asterisk Release 20.19.0-rc2

Asterisk

Door: asteriskteam

2 April 2026 om 18:41

The Asterisk Development Team would like to announce
release candidate 2 of asterisk-20.19.0.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.19.0-rc2
and
https://downloads.asterisk.org/pub/telephony/asterisk

Repository: https://github.com/asterisk/asterisk
Tag: 20.19.0-rc2

This release resolves issues reported by the community
and would have not been possible without your participation.

Thank You!

Change Log for Release asterisk-20.19.0-rc2

Links:

Summary:

Commits: 2
Commit Authors: 2
Issues Resolved: 3
Security Advisories Resolved: 0

User Notes:

Upgrade Notes:

Developer Notes:

Commit Authors:

George Joseph: (1)
nappsoft: (1)

Issue and Commit Detail:

Closed Issues:

1844: [bug]: cdrel_custom isn't respecting the default time format for CEL records
1845: [bug]:res_cdrel_custom produces wrong float timestamps
1852: [bug]: res_cdrel_custom: connection to the sqlite3 database closes from time to time

Commits By Author:

George Joseph (1):
- res_cdrel_custom: Resolve several formatting issues.
nappsoft (1):
- res_cdrel_custom: do not free config when no new config was loaded

Commit List:

res_cdrel_custom: do not free config when no new config was loaded
res_cdrel_custom: Resolve several formatting issues.

Commit Details:

res_cdrel_custom: do not free config when no new config was loaded

Author: nappsoft
Date: 2026-04-02

When the res_cdrel_custom modules is reloaded and the config has not been changed asterisk should not free the old config. Otherwise the connection to the database will be closed and no new connection will be opened.

Resolves: #1852

res_cdrel_custom: Resolve several formatting issues.

Author: George Joseph
Date: 2026-03-31

Several issues are resolved:

Internally, floats were used for timestamp values but this could result
in wrapping so they've been changed to doubles.
Historically, the default CEL eventtime format is <seconds>.<microseconds>
with <microseconds> always being 6 digits. This should have continued to be
the case but res_cdrel_custom wasn't checking the dateformat setting in
cel.conf and was defaulting to %F %T. res_cdrel_custom now gets the default
date format from cel.conf, which will be whatever the dateformat parameter
is set to or <seconds>.<microseconds> if not set.
The timeval field formatter for both CDR and CEL wasn't handling custom
strftime format strings correctly. This is now fixed so you should be able
to specifiy custom strftime format strings for the CEL eventtime and CDR
start, answer and end fields. For example: eventtime(%FT%T%z).